Systems and methods for identifying suspicious orders

ABSTRACT

Various embodiments of the present invention generally relate to systems and methods for identifying suspicious orders for controlled substances based on performing checks on a received order using historical information on previous orders. According to various embodiments, these checks may include: (1) comparing the order quantity for the received order with the order quantity history for the customer who placed the order for the controlled substance; (2) comparing the order quantity and the days since the last order was shipped to the customer for the same controlled substance with the order quantity history and the days between orders for the particular customer and controlled substance; (3) comparing the order quantity with order quantity history for orders received by customers of the same type for the controlled substance; and (4) comparing the order quantity with order quantity history for any customer for the particular controlled substance.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation application of and claims priority toand the benefit of U.S. application Ser. No. 12/729,543, filed Mar. 23,2010, the contents of which is hereby incorporated by reference herein.

BACKGROUND OF THE INVENTION Field of the Invention

Various embodiments of the disclosed invention generally relate tosystems and methods for identifying suspicious orders for controlledsubstances, and more specifically, to systems and methods foridentifying suspicious orders for controlled substances based onperforming checks on a received order using historical information onprevious orders.

Description of the Related Art

In the United States, distributors of controlled substances are requiredto be registered by the Drug Enforcement Administration (DEA). Acontrolled substance is generally understood to be a drug or chemicalsubstance whose possession and use are regulated under the UnitedStates' Controlled Substances Act, such as, for instance, manyprescription medications and narcotic drugs. Under federal regulations,a distributor must design and operate a system to disclose suspiciousorders of controlled substances. Suspicious orders may include orders ofunusual size, orders deviating substantially from a normal pattern, andorders of unusual frequency. Failure to do so may result in fines and/orloss of privilege to ship such substances.

Typically, drug distributors institute a simple, threshold-basedcalculation to determine suspicious orders. For example, a customer maybe assigned a monthly threshold for each family of controlled substancesand if the customer attempts to place an order that exceeds its monthlythreshold, the order is flagged as suspicious.

However, this threshold approach simply sets a number (e.g., threshold)based on various factors and does not automatically adjust over time asmore orders are received from customers. Further, this thresholdapproach does not consider other customers who may be placing orders forcontrolled substances within the same family. As a result, a customer'sthreshold may not be as accurate with regard to a “typical” customer whoplaces orders for controlled substances in the same family. In addition,a customer threshold may become outdated (e.g., “stale”) over time andnot representative of what should be used to flag suspicious orders. Asa consequence, the distributor's system may miss orders that should beflagged as suspicious and this may leave the distributor open topossible fines and/or loss of privilege to distribute such substances.Therefore, a need exists for an improved system and method foridentifying suspicious orders for a customer in which the system andmethod automatically account for historical order information for thecustomer as well as historical order information for other customers.

BRIEF SUMMARY OF VARIOUS EMBODIMENTS OF THE INVENTION

A system for identifying suspicious orders received for controlledsubstances according to various embodiments includes memory and one ormore processors. In particular embodiments, the one or more processorsare collectively configured to: (1) receive an order for a controlledsubstance from a customer, the order including an order quantity, anorder date, a customer identifier identifying the customer, a customertype identifier identifying a type of customer, and a substanceidentifier identifying the controlled substance; (2) query historicalorders from the memory including a historical substance identifier thatmatches the substance identifier, each historical order including ahistorical quantity, a ship date identifying the date the order wasshipped, a historical customer identifier identifying a customer whoplaced the order, and a historical customer type identifier identifyingthe type of customer; (3) apply checks to the order; and (4) in responseto the order being marked as suspicious, store information associatedwith the order in the memory to facilitate further investigation.

Further, in various embodiments, the checks include: (1) determiningwhether the order quantity is greater than a first upper control limitvalue, the first upper control limit value being derived from thehistorical quantities for a first subset of the historical orders, thefirst subset of the historical orders including the historical orderswith the historical customer identifiers that match the customeridentifier, and in response to the order quantity being greater than thefirst upper control limit value, marking the order as suspicious; (2)calculating a period of time between the order date for the order andthe ship date for a previous consecutive historical order from thehistorical orders with the historical customer identifier that matchesthe customer identifier, determining whether the order quantity isgreater than a second upper control limit value, the second uppercontrol limit value being derived from the period of time and thehistorical quantities for a second subset of the historical orders, thesecond subset of the historical orders including the historical orderswith the historical customer identifiers that match the customeridentifier, and in response to the order quantity being greater than thesecond upper control limit value, marking the order as suspicious; (3)determining whether the order quantity is greater than a first thresholdvalue, the first threshold value being derived from the historicalquantities for a third subset of the historical orders, the third subsetof the historical orders including the historical orders with thehistorical customer type identifiers that match the customer typeidentifier, and in response to the order quantity being greater than thefirst threshold value, marking the order as suspicious; and (4)determining whether the order quantity is greater than a secondthreshold value, the second threshold value being derived from thehistorical quantities of the historical orders, and in response to theorder quantity being greater than the second threshold value, markingthe order as suspicious.

In particular embodiments, the one or more processors are furthercollectively configured to prevent the order from being processed inresponse to the order being marked as suspicious. In addition, inparticular embodiments, the one or more processors are furthercollectively configured to display a result of the checks on a displaydevice in communication with the processor in response to the orderbeing marked as suspicious.

In various embodiments, the first upper control limit is derived from anexponentially-weighted moving average control chart based on thehistorical quantities for the first subset of the historical orderssorted by the ship date. Further, in particular embodiments, the secondupper control limit is derived from the period of time and a controlchart based on the formula Q=D*N and the historical quantities for thesecond subset. In these particular embodiments, Q is a replenishmentorder quantity, D is an average daily ship quantity, and N is a periodof time since a previous consecutive historical order with thehistorical customer identifier that matches the customer identifier wasshipped. In these particular embodiments, the y-axis of the controlchart includes values corresponding to D, and the x-axis of the controlchart includes values corresponding to N. In addition, in variousembodiments, the substance identifier is a Drug EnforcementAdministration (DEA) drug code, the customer identifier is a DrugEnforcement Administration (DEA) customer identifier, and/or thecustomer type is defined by Drug Enforcement Administration (DEA)registration.

A computer-implemented method for identifying suspicious orders receivedfor controlled substances according to various embodiments includes thesteps of: (1) receiving an order for a controlled substance from acustomer, the order including an order quantity, an order date, acustomer identifier identifying the customer, a customer type identifieridentifying a type of customer, and a substance identifier identifyingthe controlled substance; (2) querying historical orders from memoryincluding a historical substance identifier that matches the substanceidentifier, each historical order including a historical quantity, aship date identifying the date the order was shipped, a historicalcustomer identifier identifying a customer who placed the order, and ahistorical customer type identifier identifying the type of customer;(3) applying checks to the order via a computer device; and (4) inresponse to the order being marked as suspicious, storing informationassociated with the order in the memory to facilitate furtherinvestigation.

In particular embodiments, the checks include: (1) the computer devicedetermining whether the order quantity is greater than a first uppercontrol limit value, the first upper control limit value being derivedfrom the historical quantities for a first subset of the historicalorders, the first subset of the historical orders including thehistorical orders with the historical customer identifiers that matchthe customer identifier, and in response to the order quantity beinggreater than the first upper control limit value, marking the order assuspicious; (2) the computer device calculating a period of time betweenthe order date for the order and the ship date for a previousconsecutive historical order from the historical orders with thehistorical customer identifier that matches the customer identifier,determining whether the order quantity is greater than a second uppercontrol limit value, the second upper control limit value being derivedfrom the period of time and the historical quantities for a secondsubset of the historical orders, the second subset of the historicalorders including the historical orders with the historical customeridentifiers that match the customer identifier, and in response to theorder quantity being greater than the second upper control limit value,marking the order as suspicious; (3) the computer device determiningwhether the order quantity is greater than a first threshold value, thefirst threshold value being derived from the historical quantities for athird subset of the historical orders, the third subset of thehistorical orders including the historical orders with the historicalcustomer type identifiers that match the customer type identifier, andin response to the order quantity being greater than the first thresholdvalue, marking the order as suspicious; and (4) the computer devicedetermining whether the order quantity is greater than a secondthreshold value, the second threshold value is derived from thehistorical quantities of the historical orders, and in response to theorder quantity being greater than the second threshold value, markingthe order as suspicious.

Finally, A computer-readable medium according to various embodimentsincludes code executable by a processor to: (1) receive an order for acontrolled substance from a customer, the order including an orderquantity, an order date, a customer identifier identifying the customer,a customer type identifier identifying a type of customer, and asubstance identifier identifying the controlled substance; (2) queryhistorical orders including a historical substance identifier thatmatches the substance identifier, each historical order including ahistorical quantity, a ship date identifying the date the order wasshipped, a historical customer identifier identifying a customer whoplaced the order, and a historical customer type identifier identifyingthe type of customer; (3) apply checks to the order; and (4) in responseto the order being marked as suspicious, store information associatedwith the order in the memory to facilitate further investigation.

In particular embodiments, the checks include: (1) determining whetherthe order quantity is greater than a first upper control limit value,the first upper control limit value being derived from the historicalquantities for a first subset of the historical orders, the first subsetof the historical orders including the historical orders with thehistorical customer identifiers that match the customer identifier, andin response to the order quantity being greater than the first uppercontrol limit value, marking the order as suspicious; (2) calculating aperiod of time between the order date for the order and the ship datefor a previous consecutive historical order from the historical orderswith the historical customer identifier that matches the customeridentifier, determining whether the order quantity is greater than asecond upper control limit value, the second upper control limit valuebeing derived from the period of time and the historical quantities fora second subset of the historical orders, the second subset of thehistorical orders including the historical orders with the historicalcustomer identifiers that match the customer identifier, and in responseto the order quantity being greater than the second upper control limitvalue, marking the order as suspicious; (3) determining whether theorder quantity is greater than a first threshold value, the firstthreshold value being derived from the historical quantities for a thirdsubset of the historical orders, the third subset of the historicalorders including the historical orders with the historical customer typeidentifiers that match the customer type identifier, and in response tothe order quantity being greater than the first threshold value, markingthe order as suspicious; and (4) determining whether the order quantityis greater than a second threshold value, the second threshold value isderived from the historical quantities of the historical orders, and inresponse to the order quantity being greater than the second thresholdvalue, marking the order as suspicious.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S)

Having thus described the invention in general terms, reference will nowbe made to the accompanying drawings, which are not necessarily drawn toscale, and wherein:

FIG. 1 shows an overview of one embodiment of a system that can be usedto practice aspects of the present invention.

FIG. 2 shows an exemplary schematic diagram of an application serveraccording to one embodiment of the invention.

FIG. 3 shows a flow diagram of a check module according to oneembodiment of the invention.

FIG. 4 shows a flow diagram of the check module applying a first checkaccording to one embodiment of the invention.

FIG. 5 shows a schematic diagram of an example of anexponentially-weighted moving average control chart used in the firstcheck according to one embodiment of the invention.

FIG. 6 shows a flow diagram of the check module applying a second checkaccording to one embodiment of the invention.

FIG. 7 shows a schematic diagram of an example of a daily rate controlchart used in the second check according to one embodiment of theinvention.

FIG. 8 shows a flow diagram of the check module applying a third checkaccording to one embodiment of the invention.

FIG. 9 shows a schematic diagram of a display of the results ofevaluating an order according to one embodiment of the invention.

DETAILED DESCRIPTION OF VARIOUS EMBODIMENTS OF THE INVENTION

Various embodiments of the present invention will now be described morefully hereinafter with reference to the accompanying drawings, in whichsome, but not all embodiments of the inventions are shown. Indeed, theseinventions may be embodied in many different forms and should not beconstrued as limited to the embodiments set forth herein; rather, theseembodiments are provided so that this disclosure will satisfy applicablelegal requirements. The term “or” is used herein in both the alternativeand conjunctive sense, unless otherwise indicated. Like numbers refer tolike elements throughout.

I. METHODS, APPARATUS, SYSTEMS, AND COMPUTER PROGRAM PRODUCTS

As should be appreciated, the embodiments may be implemented in variousways, including as methods, apparatus, systems, or computer programproducts. Accordingly, the embodiments may take the form of an entirelyhardware embodiment or an embodiment in which a processor is programmedto perform certain steps. Furthermore, the various implementations maytake the form of a computer program product on a computer-readablestorage medium having computer-readable program instructions embodied inthe storage medium. Any suitable computer-readable storage medium may beutilized including hard disks, CD-ROMs, optical storage devices, ormagnetic storage devices.

Particular embodiments are described below with reference to blockdiagrams and flowchart illustrations of methods, apparatus, systems, andcomputer program products. It should be understood that each block ofthe block diagrams and flowchart illustrations, respectively, may beimplemented in part by computer program instructions, e.g., as logicalsteps or operations executing on a processor in a computing system.These computer program instructions may be loaded onto a computer, suchas a special purpose computer or other programmable data processingapparatus to produce a specifically-configured machine, such that theinstructions which execute on the computer or other programmable dataprocessing apparatus implement the functions specified in the flowchartblock or blocks.

These computer program instructions may also be stored in acomputer-readable memory that can direct a computer or otherprogrammable data processing apparatus to function in a particularmanner, such that the instructions stored in the computer-readablememory produce an article of manufacture including computer-readableinstructions for implementing the functionality specified in theflowchart block or blocks. The computer program instructions may also beloaded onto a computer or other programmable data processing apparatusto cause a series of operational steps to be performed on the computeror other programmable apparatus to produce a computer-implementedprocess such that the instructions that execute on the computer or otherprogrammable apparatus provide operations for implementing the functionsspecified in the flowchart block or blocks.

Accordingly, blocks of the block diagrams and flowchart illustrationssupport various combinations for performing the specified functions,combinations of operations for performing the specified functions andprogram instructions for performing the specified functions. It shouldalso be understood that each block of the block diagrams and flowchartillustrations, and combinations of blocks in the block diagrams andflowchart illustrations, can be implemented by special purposehardware-based computer systems that perform the specified functions oroperations, or combinations of special purpose hardware and computerinstructions.

II. EXEMPLARY SYSTEM ARCHITECTURE

FIG. 1 provides an illustration of a system 100 that can be used inconjunction with various embodiments of the present invention. Accordingto various embodiments, the system 100 may be an order system associatedwith a manufacturer and/or distributor of controlled substances. Inother embodiments, the system 100 may be a shipping system of a carrierused by the manufacturer and/or distributor of controlled substances toship controlled substances to customers. For instance, a manufacturermay contract with a carrier (such as United Parcel Service) to serve asa warehousing facility and/or distribution facility for themanufacturer. In this particular instance, the carrier may store themanufacturer's inventory of controlled substances, may receive ordersfrom customers for controlled substances, may process the orders, andmay ship portions of the inventory to the customers to fulfill theorders.

In FIG. 1, the system 100 may include a collection of servers thatprovide web services, database operations, and applications used toprocess orders received for controlled substances. For instance, thesystem 100 in FIG. 1 includes a database server 101, storage media 102,a web server 104, and an application server 103. In various embodiments,the database server 101 may include a database management system and thestorage media 102 may include one or more databases and one or moredatabase instances. In various embodiments, the storage media 102 may beone or more types of medium such as hard disks, magnetic tapes, or flashmemory. The term “database” refers to a structured collection of recordsor data that is stored in a computer system, such as via a relationaldatabase, hierarchical database, or network database. For example, inone embodiment, the storage media 102 includes a database that storeshistorical information on orders received and shipped for controlledsubstances.

In various embodiments, the web server 104 provides web services tovarious customers who may place orders for controlled substances as wellas users who review information on orders to determine whether theorders have been identified as suspicious. For instance, the web server104 delivers web pages to browsers as well as other data files toweb-based applications. Thus, in various embodiments, the web server 104includes the hardware, operating system, web server software, TCP/IPprotocols, and site content (web pages, images and other files). Thus,in various embodiments, a customer may access one or more web pagesdelivered by the web server 104 and may place an order for a controlledsubstance with the system 100. Further, in various embodiments, a usermay access one or more web pages to review information on orders thathave been reviewed to determine whether the orders are suspicious.

In the embodiment displayed in FIG. 1, the web server 104 communicatesover a network 107 (such as the Internet) with a customer's system 106.The customer's system 106 may interface with the web server 104 using abrowser residing on devices such as a desktop computer, notebook orlaptop, personal digital assistant (PDA), cell phone, or otherprocessing devices. In addition, in various embodiments, the web server104 communicates over a network 105 within the system 100 (or over anexternal network 107) with a user's computing device 108. Similar to thecustomer's system 106, the user's computing device 108 (e.g., a desktopcomputer, notebook or laptop, personal digital assistant (PDA), cellphone, or other processing devices) may interface with the web server104 using a browser residing on the user's computing device 108.

Further, in various embodiments, the application server 103 includesapplications that are used to provide functionality within the system100. For instance, in one embodiment, the application server 103includes a check module. In this particular embodiment, the check moduleprovides functionality to identify suspicious orders placed forcontrolled substances. In addition, these servers 101, 103, 104 andstorage media 102 may also be in electronic communication with oneanother within the system 100. For instance, these servers 101, 103, 104and storage media 102 may be in communication over the same or differentwireless or wired networks 105 including, for example, a wired orwireless Personal Area Network (“PAN”), Local Area Network (“LAN”),Metropolitan Area Network (“MAN”), Wide Area Network (“WAN”), theInternet, or the like. Finally, while FIG. 1 illustrates the componentsof the system 100 as separate, standalone entities, the variousembodiments of the system 100 are not limited to this particulararchitecture.

a. Application Server

FIG. 2 provides a schematic of an application server 103 according toone embodiment of the present invention. As will be understood from thisfigure, in this embodiment, the application server 103 includes aprocessor 205 that communicates with other elements within theapplication server 103 via a system interface or bus 261. The processor205 may be embodied in a number of different ways. For example, theprocessor 205 may be embodied as various processing means such as aprocessing element, a microprocessor, a coprocessor, a controller orvarious other processing devices including integrated circuits such as,for example, an application specific integrated circuit (“ASIC”), afield programmable gate array (“FPGA”), a hardware accelerator, or thelike. In an exemplary embodiment, the processor 205 may be configured toexecute instructions stored in the device memory or otherwise accessibleto the processor 205. As such, whether configured by hardware orsoftware methods, or by a combination thereof, the processor 205 mayrepresent an entity capable of performing operations according toembodiments of the present invention while configured accordingly. Adisplay device/input device 264 for receiving and displaying data isalso included in the application server 103. This display device/inputdevice 264 may be, for example, a keyboard or pointing device that isused in combination with a monitor. The application server 103 furtherincludes memory 263, which may include both read only memory (“ROM”) 265and random access memory (“RAM”) 267. The application server's ROM 265may be used to store a basic input/output system (“BIOS”) 226 containingthe basic routines that help to transfer information to the differentelements within the application server 103.

In addition, in one embodiment, the application server 103 includes atleast one storage device 268, such as a hard disk drive, a CD drive,and/or an optical disk drive for storing information on variouscomputer-readable media. The storage device(s) 268 and its associatedcomputer-readable media may provide nonvolatile storage. Thecomputer-readable media described above could be replaced by any othertype of computer-readable media, such as embedded or removablemultimedia memory cards (“MMCs”), secure digital (“SD”) memory cards,Memory Sticks, electrically erasable programmable read-only memory(“EEPROM”), flash memory, hard disk, or the like. Additionally, each ofthese storage devices 268 may be connected to the system bus 261 by anappropriate interface.

Furthermore, a number of program modules (e.g., set of computer programinstructions) may be stored by the various storage devices 268 and/orwithin RAM 267. Such program modules may include an operating system 280and a check module 300. This module 300 may control certain aspects ofthe operation of the application server 103 with the assistance of theprocessor 205 and operating system 280, although its functionality neednot be modularized.

Also located within the application server 103, in one embodiment, is anetwork interface 274 for interfacing with various computing entities,such as the web server 104, database server 101, and/or storage media102. This communication may be via the same or different wired orwireless networks (or a combination of wired and wireless networks), asdiscussed above. For instance, the communication may be executed using awired data transmission protocol, such as fiber distributed datainterface (“FDDI”), digital subscriber line (“DSL”), Ethernet,asynchronous transfer mode (“ATM”), frame relay, data over cable serviceinterface specification (“DOCSIS”), or any other wired transmissionprotocol. Similarly, the application server 103 may be configured tocommunicate via wireless external communication networks using any of avariety of protocols, such as 802.11, general packet radio service(“GPRS”), wideband code division multiple access (“W-CDMA”), or anyother wireless protocol.

It will be appreciated that one or more of the application server's 103components may be located remotely from other application server 103components. Furthermore, one or more of the components may be combinedand additional components performing functions described herein may beincluded in the application server 103.

b. Additional Exemplary System Components

The database server 101 and the web server 104 may each includecomponents and functionality similar to that of the application server103. For example, in one embodiment, each of these entities may include:(1) a processor that communicates with other elements via a systeminterface or bus; (2) a display device/input device; (3) memoryincluding both ROM and RAM; (4) a storage device; and (5) a networkinterface. Thus, these architectures are provided for exemplary purposesonly and are not limiting to the various embodiments. The terms“computing device” and “computer device” are used generically to referto any computer, computing device, desktop, notebook or laptop,distributed system, server, gateway, switch, or other processing deviceadapted to perform the functions described herein.

III. EXEMPLARY SYSTEM OPERATION

As noted above, various embodiments of the present invention providesystems and methods for identifying suspicious orders for controlledsubstances. Reference will now be made to FIGS. 3-8 which illustrateoperations and processes as produced by these various embodiments. Forinstance, FIG. 3 provides a flow diagram of a check module 300 thatperforms checks on an order received for a controlled substance todetermine whether the order should be identified as suspicious. That is,in various embodiments, the check module 300 performs checks on theorder to identify the order as an “order of interest” that may befurther investigated and deemed to be suspicious. FIG. 4 provides a flowdiagram of applying a first check on the order to determine whether theorder should be identified as suspicious according to variousembodiments. FIG. 6 provides a flow diagram of applying a second checkon the order to determine whether the order should be identified assuspicious according to various embodiments. Further, FIG. 8 provides aflow diagram of applying a third check on the order to determine whetherthe order should be identified as suspicious according to variousembodiments. The module 300 and corresponding checks are described ingreater detail below.

a. Check Module

As previously discussed, in various embodiments, the application server103 may include a check module 300 that is adapted to perform checks onan order received for a controlled substance to determine whether theorder should be identified as suspicious. As previously described, adistributor may receive the order for the controlled substance invarious ways according to embodiments. For instance, in one embodiment,the distributor's system 100 may be in direct communication with thecustomer's system. For example, the customer may send the distributor anemail or the customer's system and the distributor's system 100 mayexchange information via electronic data exchange (EDI) over a closednetwork.

In another embodiment, the customer may enter the order on a web site.In this particular embodiment, the customer visits the web site over theInternet 107 and enters the order via one or more web pages. That is, invarious embodiments, a web server 104 located within the distributor'ssystem 100 provides an interface (e.g., one or more web pages) that isconfigured to allow the customer to enter the order for a controlledsubstance.

The customer placing the order may provide several pieces of informationaccording to embodiments. For example, the customer may provide anidentifier for the controlled substance, such as a Drug EnforcementAdministration (DEA) drug code. The customer may provide an identifierthat identifies the customer, such as a DEA customer identifier.Further, the customer may provide the order quantity for the controlledsubstance, the date of placing the order, and other related informationsuch as the customer's shipping address. One of ordinary skill in theart can envision several pieces of information the customer may providewith the order in light of this disclosure.

As a result, the order is received within the distributor's system 100and the system 100 begins to process the order for fulfillment. Invarious embodiments, the distributor's system 100 engages the checkmodule 300 to perform checks on the order to determine whether the ordershould be identified as suspicious. Thus, in particular embodiments, thedistributor's system 100 passes the order to the check module 300residing on the application server 103 depicted in FIG. 1.

Accordingly, FIG. 3 illustrates a flow diagram of the check module 300according to various embodiments. This flow diagram may correspond tothe steps carried out by the processor 205 in the application server 103shown in FIG. 2 as it executes the module 300 in the server's RAM memory367 according to various embodiments.

Thus, in Step 305, the check module 300 receives the order andassociated information. In Step 310, the check module 300 querieshistorical information on previous orders for the controlled substance.For instance, in one embodiment, the distributor's system 100 includesstorage media 102 that may include one or more databases that storesinformation on previous orders placed for controlled substances.Therefore, in this embodiment, the check module 300 queries theinformation from these databases using various information received withthe order as search parameters. For example, the check module 300queries the shipped date, the sum of the shipped quantities shipped forthe date, and the number of shipments for the date based on thecontrolled substance (e.g., based on the identifier for the controlledsubstance). Further, in various embodiments, the records may be groupedaccording to ship date, customer, and/or customer type. In this example,the query may aggregate all of the multiple daily shipments for thecontrolled substance into one single daily shipped quantity.

In various embodiments, the historical information on previous orders isstored in real-time. The reason for this is because in certain instancesthe distributor may ship a controlled substance for a particular orderto a customer on a given day and may ship and/or receive another orderfor the same controlled substance on the same day. Therefore, thehistorical information must be up-to-date so that the aggregate orderquantity is accurate.

Once the check module 300 has queried all of the information, in Step315, the check module 300 applies the first check to the order. As isdescribed in further detail below, in various embodiments, the firstcheck involves the check module 300 comparing the order quantity for theorder received by the customer with the order quantity history for thecustomer for the particular controlled substance. If the check module300 determines the order fails the first check, the check module 300sets a suspicious order indicator for the order. For instance, in oneembodiment, the check module 300 sets the suspicious order indicator to“Y” as a result of the order failing the first check.

Likewise, in Step 320, the check module 300 applies the second check tothe order. In various embodiments, the second check involves the checkmodule 300 comparing the order quantity for the order received by thecustomer and the days since the last order was shipped to the customerfor the same controlled substance with the order quantity history andthe days between orders for the particular customer and controlledsubstance. It should be appreciated that the period of time may bemeasured in different units besides days for various embodiments. Forinstance, in other embodiments, the check module 300 may compare thenumber of hours, minutes, or months since the last order was shipped tothe customer for the same controlled substance.

If the check module 300 determines the order fails the second check, thecheck module 300 sets a suspicious order indicator similar to theinstance in which the order fails the first check. In one embodiment,the check module 300 sets the same suspicious order indicator as in thecase of the first check. However, in another embodiment, the checkmodule 300 sets a different suspicious order indicator. In thisparticular embodiment, each check has an independent suspicious orderindicator that is set as a result of the check module 300 determiningthat the order fails the particular check. Accordingly, the distributoris able to determine from the individual suspicious order indicatorswhich checks a particular order has failed.

In Step 325, the check module 300 applies the third check to the order.In various embodiments, the third check involves the check module 300comparing the order quantity for the order received by the customer withorder quantity history for orders received by customers of the same typefor the controlled substance. In particular embodiments, the customertype for a customer is identified by the DEA registration for thecustomer. If the check module 300 determines the order fails the thirdcheck, the check module 300 sets a suspicious order indicator. Asprevious described, the suspicious order indicator may be the sameindicator associated with the first and second checks or the indicatormay be independent and associated only with the third check.

In Step 330, the check module 300 applies the fourth check to the order.In various embodiments, the fourth check involves the check module 300comparing the order quantity for the order received by the customer withorder quantity history for any customer for the particular controlledsubstance. If the check module 300 determines the order fails the fourthcheck, the check module 300 sets a suspicious order indicator. Aspreviously described, the suspicious order indicator may be the sameindicator associated with the first, second, and third checks or theindicator may be independent and associated only with the fourth check.

Once the check module 300 has performed the four checks, in Step 335,the check module 300 determines whether the order should be identifiedas suspicious. In various embodiments, this involves the check module300 evaluating the suspicious order indicator(s). Thus, in Step 340, ifthe check module 300 determines that the lone indicator or one or moreof the individual indicators have been set as a result of the orderfailing a particular check, the check module 300 stores informationindicating that the order has been identified as suspicious in memory.

For instance, in one embodiment, the check module 300 simply storesinformation on the order in local memory residing in the applicationserver 103 depicted in FIG. 2 (e.g., the storage device 268 residing inthe application server 103). In another embodiment, the check module 300stores the information in some type of storage media. For example, thestorage media 102 shown in the distributor's system 100 depicted inFIG. 1. While in another embodiment, the check module 300 stores theinformation in some type of storage media that is external to thedistributor's system 100.

Further, the information stored by the check module 300 may includedifferent types of information according to various embodiments. Forinstance, in one embodiment, the check module 300 simply stores thesuspicious order indicator(s). While in another embodiment, as describedbelow, the check module 300 stores information in addition to thesuspicious order indicator(s) related to the check(s) performed by thecheck module 300.

It should be noted that in various embodiments the check module 300 maybe configured to determine whether the order has failed a particularcheck immediately after the check has been performed. That is, in theseparticular embodiments, the check module 300 may be configured todetermine whether the order has failed the first check immediately afterperforming the first check and before performing the second check. Ifthe order has failed the first check and the order has been identifiedas suspicious, the check module 300 may be configured to storedinformation on the suspicious order and not perform the remaining checks(e.g., the second, third, and fourth checks). The check module 300 maybe configured to perform the second, third, and fourth check in the sameway. As a result, in various embodiments, the check module 300 mayexecute more quickly than in instances in which the check module 300 isconfigured to perform all four checks regardless of whether the orderfails one of the checks.

Provided below is more detail on how the check module 300 performs thefour checks according to various embodiments of the invention. Theadditional detail is provided along with an example to betterdemonstrate the check module 300 performing these checks. Thus, theexample is provided for illustrative purposes only and should not beconstrued to limit the scope of the invention.

b. First Check

As described above, in various embodiments, the check module 300 isconfigured to apply a first check to the order received by the customerto determine whether the order should be identified as suspicious. Inparticular embodiments, this may entail the check module 300 comparingthe order quantity for the order received by the customer with the orderquantity history for the customer for the particular controlledsubstance. Accordingly, FIG. 4 illustrates a flow diagram of the checkmodule 300 performing the first check according to various embodiments.

For example, a customer enters an order for four-hundred (400) units ofthe muscle relaxant Clonazepam. In the order, the Clonazepam isidentified by its DEA drug code of 2737 and the customer is identifiedby its DEA identifier of ZZ12345678. Further, the order identifies adate of Jul. 7, 2009 as the order date.

As previous mentioned, the check module 300 receives the information onthe order and queries the historical information on previous ordersbased on one or more parameters identified in the order information. Forinstance, in the example, the check module 300 queries the historicalinformation to retrieve a sum of the shipped quantity and the number ofshipments for each ship date wherein the queried records are based onthe DEA drug code for each record being 2737 (e.g., Clonazepam) and thecustomer identifier being ZZ12345678. Thus, the check module 300 queriesthe order quantity history for orders of Clonazepam received from andshipped to the customer.

It should be noted that the unit of measure for quantity may vary fromorder to order in particular embodiments. For instance, the unit ofmeasure for quantity may be each (EA), grams (GM), and/or milliliter(ML). Therefore, in these particular embodiments, the unit of measuremay also be used as a parameter in querying records from the historicalinformation.

Once the check module 300 has queried the historical information, thecheck module 300 performs the first check. In various embodiments, thecheck module 300 makes use of one or more control charts for this check(e.g., data associated with control charts). A control chart is a toolused in statistical quality control to determine if a process isoperating within a specified range, or is “in control.” In this case,“in control” implies that the order quantity is typical when compared topast orders. In particular embodiments, the check module 300 isconfigured to plot the order quantity by order date and use anexponentially-weighted moving average (EWMA) chart to determine whetherthe order quantity stays within confidence limits based on past orderhistory. The EWMA chart is used in these particular embodiments becausethe chart can adapt to small and gradual drifts in the order quantitybut identify large and quick changes.

Further, in various embodiments, two parameters are defined prior to thecheck module 300 creating the EWMA control chart. The first parameter isan update parameter. In various embodiments, this parameter is set to avalue between zero (0) and one (1) and indicates how much weight isgiven to the current value and how much weight is given to the previousEWMA. Values closer to one (1) direct the algorithm to weight thecurrent order quantity more heavily and give less weight to olderorders, causing the EWMA to adapt more quickly to changes. In particularembodiments, a default value of 0.4 is used.

The second parameter is a sigma multiplier for an upper control limit.This parameter controls the confidence level of the chart. A defaultvalue of 3.0 indicates that the control limit should be set such that99.7% of the order quantities following a normal distribution will bewithin the limit. Lowering the value to 1.96 will reduce the percentageto 95%. Thus, in various embodiments, the tradeoff of lowering the valueis identifying more “false positives” versus possibly missing asuspicious order with a higher value of sigma.

Therefore, in various embodiments, the check module 300 calculates theEWMA chart based on the historical order quantities and the orderquantity for the order received by the customer, shown as Step 405. Inparticular embodiments, the EWMA chart is sorted by shipped date. Inaddition, in particular embodiments, the check module 300 calculates thestandard deviation and determines the upper control limit (UCL) for theEWMA chart.

Thus, in Step 410, the check module 300 compares the EWMA value for theorder quantity for the order received from the customer with the uppercontrol limit. In Step 415, the check module 300 determines whether theEWMA value for the order quantity is greater than the upper controllimit. If the check module 300 determines the EWMA value for the orderquantity is greater than the upper control limit, the check module 300sets the suspicious order indicator for the order, shown as Step 420.

Therefore, returning to the example, the check module 300 calculates theEWMA chart for the historical order quantities and the order quantityfor the order received by the customer and determines that the uppercontrol limit for the chart is 159.8 units. The chart is shown in FIG. 5and the upper control limit 505 is shown as the straight line above theindividual data points. The EWMA value for the order quantity for theorder received by the customer is represented as the last data point 510shown in the timeline. As can be seen, the data point 510 for the orderquantity for the order is above the upper control limit 505. That is,the EWMA value of the order quantity of 400 is greater than the uppercontrol limit of 159.8. Thus, the check module 300 determines that theEWMA value of the order quantity is greater than the upper controllimit, and as a result the module 300 sets the suspicious order indictorfor the order.

c. Second Check

Further, in various embodiments, the check module 300 is configured toapply a second check to the order received by the customer to determinewhether the order should be identified as suspicious. In particularembodiments, this may entail the check module 300 comparing the orderquantity for the order received by the customer and the days since thelast order was shipped to the customer for the same controlled substancewith the order quantity history and the days between orders for theparticular customer and controlled substance. Accordingly, FIG. 6illustrates a flow diagram of the check module 300 performing the secondcheck according to various embodiments.

In various embodiments, the check module 300 factors in a period of time(e.g., number of days) since the last order was shipped for thecontrolled substance and the order quantity on the last order todetermine an order rate that is typical and then compares the order withrespect to the order rate. For instance, in one embodiment, the checkmodule 300 uses the equation Q=D*N to define a line in whichreplenishment orders received from the customer for the controlledsubstance should fall close to. (In the equation Q=D*N, Q is thereplenishment order quantity, D is the average daily ship rate (e.g.,the average daily ship quantity), and N is the time period (e.g., numberof days) since the last replenishment order was placed.) With the use ofthis equation, the variability is expected to increase as the timeperiod between orders gets larger in various embodiments. As a result,the upper control limit for a control chart based on the equation is afunction of both quantity and time.

Thus, in Step 605, the check module 300 calculates a control chart basedon the queried historical information on previous orders received fromthe customer for the controlled substance. For instance, in oneparticular embodiment, the control chart includes an x-axis of timeperiod between consecutive orders (e.g., number of days betweenconsecutive orders) and a y-axis of daily shipped quantity.

Further, in Step 610, the check module 300 calculates the period of timesince the last order was shipped for the customer for the controlledsubstance. The check module 300 then compares the order quantity to theupper control limit for the corresponding time period on the x-axis ofthe control chart, shown as Step 615. In Step 620, the check module 300determines whether the order quantity is greater than the upper controllimit that corresponds to the calculated period of time. If the checkmodule 300 determines that the order quantity is greater than the uppercontrol limit, the check module 300 sets the suspicious order indicatorfor the order, shown as Step 625.

Thus, returning to the example, the check module 300 calculates thecontrol chart depicted in FIG. 7 based on the historical information.Further, the check module 300 calculates that is has been eight dayssince the previous order of Clonazepam was shipped to the customer.Therefore, the check module 300 determines whether the order quantityfor the order of Clonazepam is greater than the upper control limit 705that corresponds to eight days on the x-axis of the control chart. Inthis case, the order quantity 710 of 400 units is greater than the uppercontrol limit 705 of 376 units. As a result, the check module 300 setsthe suspicious order indicator for the order.

d. Third Check

As previously mentioned, in various embodiments, the check module 300 isalso configured to apply a third check to the order received by thecustomer to determine whether the order should be identified assuspicious. In particular embodiments, this may entail the check module300 comparing the order quantity for the order received by the customerwith order quantity history for orders received by customers of the sametype for the controlled substance. Accordingly, FIG. 8 illustrates aflow diagram of the check module 300 performing the third checkaccording to various embodiments.

As mentioned, in various embodiments, the check module 300 querieshistorical information of previous orders for the controlled substance.Further, as mentioned, in various embodiments, the queried record may begrouped by customer type. In particular embodiments, the customer typemay be the customer type assigned by the DEA. Thus, in these particularembodiments, the check module 300 retrieves the records from thehistorical information with the same identifier for the controlledsubstance and the same customer type as the customer who placed theorder. That is, the check module 300 may retrieve the records from therecords originally queried from the historical information (e.g., asubset of the queried records) or the check module 300 may query thehistorical information directly for the records.

In Step 805, the check module 300 begins the process for applying thethird check by calculating a threshold value based on the queriedhistorical information to compare to the order quantity received on theorder for the controlled substance. For instance, in variousembodiments, the check module 300 simply sets the threshold value to apercentage of the historical order quantities that the order quantityfor the order received must fall under. For example, the threshold valuemay be set to 95% and therefore the order quantity must be within theorder quantities of 95% of the historical orders received and shippedfor the controlled substance for the customer type. Yet, in otherembodiments, the check module 300 calculates a threshold value based onusing either a common or a specialized probability distribution modelfor the historical quantities for the customer type. For example, thecheck module 300 uses a normal distribution and sets the threshold valueto the ninety-fifth percentile (e.g., two standard deviations of themean).

Following the calculation, the check module 300 compares the orderquantity on the order received from the customer with the thresholdvalue, in Step 810. In Step 815, the check module 300 determines whetherthe order quantity is greater than the threshold value. In Step 820, ifthe check module 300 determines the order quantity is greater than thethreshold value, the check module 300 sets the suspicious orderindicator for the order.

Thus, returning to the example, the customer type for the customer whohas placed the order is “Retail Pharmacy.” The check module 300retrieves four-hundred and fifty-nine records for historical ordersshipped for the controlled substance Clonazepam to customers with thecustomer type of “Retail Pharmacy.” The check module 300 sets thethreshold value to 95%, evaluates the historical order quantities forClonazepam, and determines the order quantity received for the order bythe customer of 400 is higher than 98% of the historical orderquantities for customers of the same type. As a result, the check module300 sets the suspicious order indicator for the order.

d. Fourth Check

Further, in various embodiments, the check module 300 is configured toapply a fourth check to the order received by the customer to determinewhether the order should be identified as suspicious. In particularembodiments, this may entail the check module 300 comparing the orderquantity for the order received by the customer with order quantityhistory for any customer for the particular controlled substance. Thus,the check module 300 basically performs the same steps as the thirdcheck with a different set of retrieved historical records. In thisparticular instance, the check module 300 does not limit the retrievedrecords to the same customer type as the customer who placed the order.The check module 300 retrieves records for all of the historical ordersplaced and shipped for the controlled substance.

Similar to the third check, the check module 300 sets a threshold valueand determines whether the order quantity for the order received fromthe customer is greater than the threshold. In various embodiments, thecheck module 300 sets the threshold using similar mechanisms asdescribed above with respect to the third check. Therefore, returning tothe example, the check module 300 retrieves three-thousand nine-hundredand seventeen historical records for orders received and shipped forClonazepam. The check module 300 sets the threshold value to 95%,evaluates the historical order quantities for Clonazepam, and determinesthe order quantity received for the order by the customer of 400 ishigher than 86% of the historical order quantities for all customers. Asa result, the check module 300 does not set the suspicious orderindicator for the order.

III. EXEMPLARY INTERFACES

As previously described, in various embodiments, the check module 300stores information, in addition to the suspicious order indicators,related to the checks performed by the check module 300. Further, invarious embodiments, the distributor's system 100 may include aninterface that displays the results of the checks. In particularembodiments, this interface may be provided by the check module 300 andis accessed via a user interacting directly with the check module 300.For example, a user may interact with the check module 300 over anetwork 105 within the distributor's system 100 and the check module 300provides one or more screens that serve as an interface. While in otherembodiments, the interface may be provided as one or more web pages viathe web server 104. For instance, in these particular embodiments, theweb server 104 may communication with the check module 300 residing onthe application server 103 and/or the storage 102 over the network 105and may provide one or more web pages to display information gatheredfrom the check module 300 and/or storage 102 on the checks performed bythe check module 300. Thus, a user logs onto a web site associated withthe distributor via a browser on the user's computing device 108 andinteracts with the interface via the one or more web pages.

Shown in FIG. 9 is an example of an embodiment of an interface thatpresents the results of the checks performed on the order received fromcustomer ZZ12345678 for 400 units of Clonazepam (e.g., drug code 2737).The interface displays the results of each check performed for the order901, 902, 903, 904. For instance, the interface displays that the orderhas failed checks one, two, and three. In addition, the interfaceprovides selection mechanisms 905, 906 (e.g., buttons) that allow a userto view the control charts associated with the first check and thesecond check. Further, the interface provides a description of eachcheck 907, 908, 909, 910 and the results of each check along withinstructions based on the results 911, 912, 913, 914.

IV. CONCLUSION

Many modifications and other embodiments of the inventions set forthherein will come to mind to one skilled in the art to which theseinventions pertain having the benefit of the teachings presented in theforegoing descriptions and the associated drawings. Therefore, it is tobe understood that the inventions are not to be limited to the specificembodiments disclosed and that modifications and other embodiments areintended to be included within the scope of the appended claims.Although specific terms are employed herein, they are used in a genericand descriptive sense only and not for purposes of limitation.

What is claimed is:
 1. A distributor system for identifying suspiciousorders received for controlled substances, the distributor systemcomprising: memory; and one or more processors collectively configuredto: receive, over a network and at the distributor system, an order fora controlled substance from a customer, the order comprising an orderquantity, an order date, a customer identifier identifying the customer,a customer type identifier identifying a type of customer, and asubstance identifier identifying the controlled substance; queryhistorical orders from the memory comprising a historical substanceidentifier that matches the substance identifier, each historical ordercomprising a historical quantity, a ship date identifying the date theorder was shipped, a historical customer identifier identifying acustomer who placed the order, and a historical customer type identifieridentifying the type of customer; prior to applying checks,automatically update the historical orders in real-time with thereceived order; apply the checks to the order, the checks comprising acombination of at least two and no more than three checks selected fromthe group consisting of: (1) a first check comprising determiningwhether the order quantity is greater than a first upper control limitvalue, the first upper control limit value being derived from thehistorical quantities for a first subset of the historical orders, thefirst subset of the historical orders comprising the historical orderswith the historical customer identifiers that match the customeridentifier, and in response to the order quantity being greater than thefirst upper control limit value, marking the order as suspicious; (2) asecond check comprising calculating a period of time between the orderdate for the order and the ship date for a previous consecutivehistorical order from the historical orders with the historical customeridentifier that matches the customer identifier, determining whether theorder quantity is greater than a second upper control limit value, thesecond upper control limit value being derived from the period of timeand the historical quantities for a second subset of the historicalorders, the second subset of the historical orders comprising thehistorical orders with the historical customer identifiers that matchthe customer identifier, and in response to the order quantity beinggreater than the second upper control limit value, marking the order assuspicious; (3) a third check comprising determining whether the orderquantity is greater than a first threshold value, the first thresholdvalue being derived from the historical quantities for a third subset ofthe historical orders, the third subset of the historical orderscomprising the historical orders with the historical customer typeidentifiers that match the customer type identifier, and in response tothe order quantity being greater than the first threshold value, markingthe order as suspicious; and (4) a fourth check comprising determiningwhether the order quantity is greater than a second threshold value, thesecond threshold value being derived from the historical quantities ofthe historical orders, and in response to the order quantity beinggreater than the second threshold value, marking the order assuspicious; and in response to the order being marked as suspicious:store information associated with the order in the memory, saidinformation comprising one or more suspicious order indicators, resultsassociated with one or more of the performed checks, and instructionsbased upon the results; and transmit the information associated with theorder over the network to a user interface, said user interfaceproviding one or more selection mechanisms that allow a user to view andtake action upon the information associated with the order for purposesof further investigation, said action taken being based at least in parton the results and instructions and prior to fulfillment of the order.2. The system of claim 1, wherein the combination of checks comprisesany two of the following: the first check, the second check, the thirdcheck, and the fourth check.
 3. The system of claim 1, wherein thecombination of checks comprises any three of the following: the firstcheck, the second check, the third check, and the fourth check.
 4. Thesystem of claim 1, wherein: the combination of checks comprises at leastthe first check; and the first upper control limit is further derivedfrom an exponentially-weighted moving average control chart based on thehistorical quantities for the first subset of the historical orderssorted by the ship date, wherein the exponentially-weighted movingaverage control chart is created based on an update parameter thatindicates a first weight for a current value associated with anexponentially-weighted moving average and a second weight for a previousvalue associated with the exponentially-weighted moving average, and iscreated based on a sigma multiplier parameter for the first uppercontrol limit that indicates a confidence level of theexponentially-weighted moving average control chart.
 5. The system ofclaim 4, wherein the combination of checks further comprise at least oneand no more than two of any of the second check, the third check, andthe fourth check.
 6. The system of claim 1, wherein: the combination ofchecks comprises at least the second check; and the second upper controllimit is further derived from the period of time and a control chartbased on the formula Q=D*N and the historical quantities for the secondsubset, Q comprises a replenishment order quantity, D comprises anaverage daily ship quantity, N comprises a period of time since aprevious consecutive historical order with the historical customeridentifier that matches the customer identifier was shipped, a y-axis ofthe control chart comprises values corresponding to D, and an x-axis ofthe control chart comprises values corresponding to N.
 7. The system ofclaim 6, wherein the combination of checks further comprise at least oneand no more than two of any of the first check, the third check, and thefourth check.
 8. The system of claim 1, wherein at least one of thesubstance identifier, the customer identifier, and the customer type isa Drug Enforcement Administration (DEA) customer identifier.
 9. Acomputer-implemented method for identifying suspicious orders receivedfor controlled substances, the method comprising the steps of:receiving, over a network and at a distributor system, an order for acontrolled substance from a customer, the order comprising an orderquantity, an order date, a customer identifier identifying the customer,a customer type identifier identifying a type of customer, and a substance identifier identifying the controlled substance; queryinghistorical orders from memory comprising a historical substanceidentifier that matches the substance identifier, each historical ordercomprising a historical quantity, a ship date identifying the date theorder was shipped, a historical customer identifier identifying acustomer who placed the order, and a historical customer type identifieridentifying the type of customer; automatically updating the historicalorders in real-time with the received order; applying checks to theorder via a computer device, the checks comprising a combination of atleast two and no more than three checks selected from the groupconsisting of: (1) a first check comprising the computer devicedetermining whether the order quantity is greater than a first uppercontrol limit value, the first upper control limit value being derivedfrom the historical quantities for a first subset of the historicalorders, the first subset of the historical orders comprising thehistorical orders with the historical customer identifiers that matchthe customer identifier, and in response to the order quantity beinggreater than the first upper control limit value, marking the order assuspicious; (2) a second check comprising the computer devicecalculating a period of time between the order date for the order andthe ship date for a previous consecutive historical order from thehistorical orders with the historical customer identifier that matchesthe customer identifier, determining whether the order quantity isgreater than a second upper control limit value, the second uppercontrol limit value being derived from the period of time and thehistorical quantities for a second subset of the historical orders, thesecond subset of the historical orders comprising the historical orderswith the historical customer identifiers that match the customeridentifier, and in response to the order quantity being greater than thesecond upper control limit value, marking the order as suspicious; (3) athird check comprising the computer device determining whether the orderquantity is greater than a first threshold value, the first thresholdvalue being derived from the historical quantities for a third subset ofthe historical orders, the third subset of the historical orderscomprising the historical orders with the historical customer typeidentifiers that match the customer type identifier, and in response tothe order quantity being greater than the first threshold value, markingthe order as suspicious; and (4) a fourth check comprising the computerdevice determining whether the order quantity is greater than a secondthreshold value, the second threshold value is derived from thehistorical quantities of the historical orders, and in response to theorder quantity being greater than the second threshold value, markingthe order as suspicious; and in response to the order being marked assuspicious: storing information associated with the order in the memory,said information comprising one or more suspicious order indicators,results associated with one or more of the performed checks, andinstructions based upon the results; and transmitting the informationassociated with the order over the network to a user interface, saiduser interface providing one or more selection mechanisms that allow auser to view and take action upon the information associated with theorder for purposes of further investigation, said action taken beingbased at least in part on the results and instructions and prior tofulfillment of the order.
 10. The method of claim 9, wherein thecombination of checks comprises any two of the following: the firstcheck, the second check, the third check, and the fourth check.
 11. Themethod of claim 9, wherein: the combination of checks comprises at leastthe first check; and the first upper control limit is further derivedfrom an exponentially-weighted moving average control chart based on thehistorical quantities for the first subset of the historical orderssorted by the ship date.
 12. The method of claim 11, wherein thecombination of checks further comprise at least one and no more than twoof any of the second check, the third check, and the fourth check. 13.The method of claim 9, wherein: the combination of checks comprises atleast the second check; and the second upper control limit is furtherderived from the period of time and a control chart based on the formulaQ=D*N and the historical quantities for the second subset, Q comprises areplenishment order quantity, D comprises an average daily shipquantity, N comprises a period of time since a previous consecutivehistorical order with the historical customer identifier that matchesthe customer identifier was shipped, a y-axis of the control chartcomprises values corresponding to D, and an x-axis of the control chartcomprises values corresponding to N.
 14. The method of claim 13, whereinthe combination of checks further comprise at least one and no more thantwo of any of the first check, the third check, and the fourth check.15. The method of claim 9, wherein at least one of the substanceidentifier, the customer identifier, and the customer type is a DrugEnforcement Administration (DEA) customer identifier.
 16. The method ofclaim 9, further comprising the step of preventing the order from beingprocessed in response to the order being marked as suspicious.
 17. Anon-transitory computer-readable medium comprising code executable by aprocessor to: receive, over a network and at a distributor system, anorder for a controlled substance from a customer, the order comprisingan order quantity, an order date, a customer identifier identifying thecustomer, a customer type identifier identifying a type of customer, anda substance identifier identifying the controlled substance; queryhistorical orders comprising a historical substance identifier thatmatches the substance identifier, each historical order comprising ahistorical quantity, a ship date identifying the date the order wasshipped, a historical customer identifier identifying a customer whoplaced the order, and a historical customer type identifier identifyingthe type of customer automatically update the historical orders inreal-time with the received order; apply checks to the order, the checkscomprising a combination of at least two and no more than three checksselected from the group consisting of: (1) a first check comprisingdetermining whether the order quantity is greater than a first uppercontrol limit value, the first upper control limit value being derivedfrom the historical quantities for a first subset of the historicalorders, the first subset of the historical orders comprising thehistorical orders with the historical customer identifiers that matchthe customer identifier, and in response to the order quantity beinggreater than the first upper control limit value, marking the order assuspicious; (2) a second check comprising calculating a period of timebetween the order date for the order and the ship date for a previousconsecutive historical order from the historical orders with thehistorical customer identifier that matches the customer identifier,determining whether the order quantity is greater than a second uppercontrol limit value, the second upper control limit value being derivedfrom the period of time and the historical quantities for a secondsubset of the historical orders, the second subset of the historicalorders comprising the historical orders with the historical customeridentifiers that match the customer identifier, and in response to theorder quantity being greater than the second upper control limit value,marking the order as suspicious; (3) a third check comprisingdetermining whether the order quantity is greater than a first thresholdvalue, the first threshold value being derived from the historicalquantities for a third subset of the historical orders, the third subsetof the historical orders comprising the historical orders with thehistorical customer type identifiers that match the customer typeidentifier, and in response to the order quantity being greater than thefirst threshold value, marking the order as suspicious; and (4) a fourthcheck comprising determining whether the order quantity is greater thana second threshold value, the second threshold value is derived from thehistorical quantities of the historical orders, and in response to theorder quantity being greater than the second threshold value, markingthe order as suspicious; and in response to the order being marked assuspicious: store information associated with the order in the memory,said information comprising one or more suspicious order indicators,results associated with one or more of the performed checks, andinstructions based upon the results; and transmit the informationassociated with the order over the network to a user interface, saiduser interface providing one or more selection mechanisms that allow auser to view and take action upon the information associated with theorder for purposes of further investigation, said action taken beingbased at least in part on the results and instructions and prior tofulfillment of the order.
 18. The computer-readable medium of claim 17,wherein the combination of checks comprises any two of the following:the first check, the second check, the third check, and the fourthcheck.
 19. The computer-readable medium of claim 17, wherein: thecombination of checks comprises at least the first check; and the firstupper control limit is further derived from an exponentially-weightedmoving average control chart based on the historical quantities for thefirst subset of the historical orders sorted by the ship date.
 20. Thecomputer-readable medium of claim 17, wherein: the combination of checkscomprises at least the second check; and the second upper control limitis further derived from the period of time and a control chart based onthe formula Q=D*N and the historical quantities for the second subset, Qcomprises a replenishment order quantity, D comprises an average dailyship quantity, N comprises a period of time since a previous consecutivehistorical order with the historical customer identifier that matchesthe customer identifier was shipped, a y-axis of the control chartcomprises values corresponding to D, and an x-axis of the control chartcomprises values corresponding to N.